don't validate the js text in a $where

fixes #2329
MorphiaOrg · Apr 18, 2023 · 07d3563 · 07d3563
1 parent affca3d
commit 07d3563
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 1 deletion.
diff --git a/core/src/main/java/dev/morphia/query/filters/Filters.java b/core/src/main/java/dev/morphia/query/filters/Filters.java
@@ -619,7 +619,7 @@ public static Filter where(String val) {
             @Override
             public void encode(Datastore datastore, BsonWriter writer, EncoderContext context) {
                 writer.writeName(getName());
-                Object where = getValue(datastore);
+                Object where = getValue();
                 if (where != null) {
                     String value = where.toString().trim();
                     if (!value.startsWith("function()")) {

diff --git a/core/src/test/java/dev/morphia/test/query/FiltersTest.java b/core/src/test/java/dev/morphia/test/query/FiltersTest.java
@@ -11,6 +11,8 @@
 
 import dev.morphia.aggregation.expressions.ComparisonExpressions;
 import dev.morphia.aggregation.expressions.Miscellaneous;
+import dev.morphia.annotations.Entity;
+import dev.morphia.annotations.Id;
 import dev.morphia.query.FindOptions;
 import dev.morphia.query.Meta;
 import dev.morphia.query.Query;
@@ -45,7 +47,9 @@
 import static dev.morphia.query.filters.Filters.size;
 import static dev.morphia.query.filters.Filters.text;
 import static dev.morphia.query.filters.Filters.type;
+import static dev.morphia.query.filters.Filters.where;
 import static java.util.Arrays.asList;
+import static java.util.List.of;
 import static org.bson.Document.parse;
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNull;
@@ -334,4 +338,27 @@ public void testSize() {
 
         assertNull(likes);
     }
+
+    @Test
+    public void testWhere() {
+        getMapper().map(Player.class);
+        insert("players", of(
+                parse("{ _id: 12378, name: 'Steve', username: 'steveisawesome', first_login: '2017-01-01' }"),
+                parse("{ _id: 2, name: 'Anya', username: 'anya', first_login: '2001-02-02' }")));
+
+        Player player = getDs().find(Player.class)
+                .filter(where("return (hex_md5(this.name) == '9b53e667f30cd329dca1ec9e6a83e994')"))
+                .first();
+
+        assertEquals(player.name, "Anya");
+    }
+
+    @Entity(value = "players", useDiscriminator = false)
+    private static class Player {
+        @Id
+        private int id;
+        String name;
+        String username;
+        String first_login;
+    }
 }